8

I disassembled a misbehaving dll with IDA and identified the faulty code. Now I want to go one step further and replace the function with a self-written, hopefully less faulty one. The dll I'm talking about is written in C/C++ and the function in question is not exported.

What would be a practicable way to overwrite/replace this function along with relocation information and all? Everything I found on the net was about rebuilding MSIL dll's.

My guess would be to write a new function in assembler, assemble it, create a new section in the dll, put the code there and somehow introduce a call to the new function at the beginning of the original implementation. But I don't know these steps would exactly look or how to merge the relocation info etc. Or is there a better solution? Are there any primers or tools to help me get such a thing done?

Edit: Meanwhile I found articles about similar topics

2 Answers 2

11

I think you have 4 options here:

  1. Overwrite the function in assembler using OllyDbg, IDA Pro or any other tool. However, you may not have enough space.
  2. Insert a jmp to another place where you have enough space to do this. You will likely need to find for "holes" between sections where you can put your code.
  3. Add a new section to the PE/ELF file, mark it as executable and then put a jmp in the function you want to overwrite to go to your new code, that will be in the new section. You can make it as big as you need, as long as you rebuild correctly the PE/ELF header.
  4. The way I like the most: overwrite the function with the assembly code to load another library, resolve a function exported by this library and call this function. The other library would be one that you can write in the high level language you prefer as long as you take care of the calling conventions, etc...

The option #4 is the best because it allows you to write in high level code your logic and you only need to write in assembler the LoadLibrary (or dlopen), GetProcAddress and the final calling code. And only once. Then you can modify as many times as you want the library with your code.

2
  • Could you please clarify some points for me? Ad 1-3: Is it right that I can't use absolute addresses for jumps without also modifying relocation information? So how do I jump into another section or refer to data sections etc? Ad 4 and general: Are there any papers/books about that? Apr 15, 2014 at 18:07
  • You can use absolute addresses as long as you don't move the sections (otherwise, except for a DLL, you would need to relocate all the code). As for papers/books on this topic, I don't know, sorry. Apr 17, 2014 at 7:48
0

After putting more thorough thinking into this I decided to go with option 1 in joxeankoret's list. As the main focus of the fix is reordering some actions and the code is interspersed with debug logging calls I might get away with some pc relative short jumps overwriting the debug code.

Some additional info to extend joxeankoret's answer and my comment:

One hardcore solution to the absolute address problem seems to be to completely remove the relocation section.

Another possiblity is to use the Relocation Section Editor to manually edit/add/remove the relocations.

Regarding option 4, there seems to be the possibility to edit the PE import address table to omit the LoadLibrary/GetProcAddress code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.